CVE-2026-42880 argoproj CVE debrief

Who should care

Users of Argo CD, especially those with read-only access, should be aware of this vulnerability and take immediate action to patch their systems. Kubernetes administrators and security teams should prioritize patching Argo CD instances to prevent potential data breaches. Additionally, defenders should review their inventory of Argo CD instances and monitor for any suspicious activity.

Technical summary

The vulnerability in Argo CD's ServerSideDiff endpoint allows an attacker to exploit a missing authorization and data-masking gap. This gap enables an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. The issue is caused by the lack of proper authorization and data masking in the ServerSideDiff endpoint. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. The weakness associated with this vulnerability includes CWE-200, CWE-212, and CWE-201.

Defensive priority

High priority should be given to patching Argo CD instances to prevent exploitation of this vulnerability. Defenders should also review their inventory of Argo CD instances and monitor for any suspicious activity.

Recommended defensive actions

• Patch Argo CD instances to versions 3.2.11 or 3.3.9.
• Review inventory of Argo CD instances.
• Monitor for suspicious activity.
• Restrict access to the ServerSideDiff endpoint.
• Implement additional security measures to protect Kubernetes Secret data.

Evidence notes

The CVE-2026-42880 vulnerability was published on May 7, 2026, and modified on June 30, 2026. The vulnerability affects Argo CD versions from 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9. The CVSS score for this vulnerability is 9.6, indicating a critical severity level.

Official resources